Compliance Assessment ToolSAQ D: who needs it?
SAQ D is the full PCI self-assessment. It applies when card numbers reach your own systems — your website accepts them, or you store them — or when no shorter SAQ fits.
This is probably you if…
- Your own website or app receives card numbers.
- You store card numbers electronically, anywhere.
- Your setup does not meet the conditions of any shorter SAQ.
Typical setups
- A custom checkout that posts card numbers to your own server.
- A business that keeps card numbers in a database or spreadsheet for repeat billing.
It's probably not SAQ D if…
- You are only on SAQ D because nobody checked the shorter options — many businesses qualify for SAQ A, B-IP, C-VT, P2PE or SPoC with a small change in setup.
Not sure it's SAQ D?
Describe how you take payments in your own words and we'll check it against every SAQ's conditions — free. If it is SAQ D, we walk you through it in plain English and produce your signed SAQ and Attestation of Compliance.
Check my SAQ — free →The official eligibility criteria
To use SAQ D, the PCI Security Standards Council requires all of the following:
- E-commerce merchants that accept account data on their website.
- Merchants with electronic storage of account data.
- Merchants that don't store account data electronically but that do not meet the criteria of another SAQ type.
- Merchants with environments that might meet the criteria of another SAQ type, but that have additional PCI DSS requirements applicable to their environment.
Questions people ask
Can I avoid SAQ D?
Often. Moving checkout to your provider's hosted page, or switching to a validated P2PE or SPoC terminal, can move you to a much shorter SAQ. The safest way to know is to describe exactly how you take payments and check each SAQ's conditions.
Is SAQ D the same as a QSA audit?
No. SAQ D is still a self-assessment. Some businesses — typically very large ones — are required by their acquirer to undergo an on-site assessment by a Qualified Security Assessor instead.
Other SAQ types
SAQ A · SAQ A-EP · SAQ B · SAQ B-IP · SAQ C · SAQ C-VT · SAQ P2PE · SAQ SPoC
This guide helps you identify the right self-assessment questionnaire. Your acquiring bank or payment processor decides which SAQ you must submit — confirm with them if you are unsure. Compliance Assessment Tool helps you complete a PCI DSS self-assessment; we are not a Qualified Security Assessor (QSA) and do not certify compliance. Eligibility criteria quoted from PCI DSS v4.0.1 SAQ D documentation published by the PCI Security Standards Council.